Changeset 2a1ffd6 in mod_gnutls

Timestamp:

May 31, 2016, 1:12:53 PM (2 years ago)

Author:

Thomas Klute <thomas2.klute@…>

Branches:

debian/master, debian/stretch-backports, master, upstream

Children:

64856fd

Parents:

d35b98e

Message:

Move trust list generation for OCSP to a separate function

The new function is supposed be used during server configuration
later, instead of recreating the trust list every time an OCSP
response is checked.

Location:

src

Files:

• gnutls_ocsp.c (modified) (4 diffs)
• gnutls_ocsp.h (modified) (2 diffs)

src/gnutls_ocsp.c

@@ -86 +86 @@
         return GNUTLS_E_NO_CERTIFICATE_FOUND;
     }
-    gnutls_x509_trust_list_t issuer;
-    int ret = gnutls_x509_trust_list_init(&issuer, 1);
-    if (ret != GNUTLS_E_SUCCESS)
-    {
-        ap_log_cerror(APLOG_MARK, APLOG_ERR, APR_EGENERAL, ctxt->c,
-                      "Could not create issuer trust list: %s (%d)",
-                      gnutls_strerror(ret), ret);
-        goto trust_cleanup;
-    }
+
     /* Only the direct issuer may sign the OCSP response or an OCSP
      * signer. Assuming the certificate file is properly ordered, it
      * should be the one directly after the server's. */
-    ret = gnutls_x509_trust_list_add_cas(issuer,
+    gnutls_x509_trust_list_t issuer;
+    int ret = mgs_create_ocsp_trust_list(&issuer,
                                          &(ctxt->sc->certs_x509_crt_chain[1]),
-                                         1, 0);
-    if (ret != 1)
-    {
-        ap_log_cerror(APLOG_MARK, APLOG_ERR, APR_EGENERAL, ctxt->c,
-                      "Could not populate issuer trust list.");
-        ret = GNUTLS_E_CERTIFICATE_ERROR;
-        goto trust_cleanup;
+                                         1);
+    if (ret != GNUTLS_E_SUCCESS)
+    {
+        ap_log_cerror(APLOG_MARK, APLOG_ERR, APR_EGENERAL, ctxt->c,
+                      "Could not create issuer trust list: %s (%d)",
+                      gnutls_strerror(ret), ret);
+        return ret;
     }
 
@@ -205 +198 @@
             ap_log_cerror(APLOG_MARK, APLOG_ERR, APR_EGENERAL, ctxt->c,
                           "OCSP response has expired at %s!", date_str);
+            /* Do not send a stale response */
             ret = GNUTLS_E_OCSP_RESPONSE_ERROR;
             goto resp_cleanup;
@@ -229 +223 @@
  resp_cleanup:
     gnutls_ocsp_resp_deinit(resp);
- trust_cleanup:
     /* deinit trust list, but not the certificates */
     gnutls_x509_trust_list_deinit(issuer, 0);
@@ -265 +258 @@
     return GNUTLS_E_NO_CERTIFICATE_STATUS;
 }
+
+
+
+int mgs_create_ocsp_trust_list(gnutls_x509_trust_list_t *tl,
+                               const gnutls_x509_crt_t *chain,
+                               const int num)
+{
+    int added = 0;
+    int ret = gnutls_x509_trust_list_init(tl, num);
+
+    if (ret == GNUTLS_E_SUCCESS)
+        added = gnutls_x509_trust_list_add_cas(*tl, chain, num, 0);
+
+    if (added != num)
+        ret = GNUTLS_E_CERTIFICATE_ERROR;
+
+    /* Clean up trust list in case of error */
+    if (ret != GNUTLS_E_SUCCESS)
+        gnutls_x509_trust_list_deinit(*tl, 0);
+
+    return ret;
+}

src/gnutls_ocsp.h

@@ -19 +19 @@
 
 #include "gnutls/gnutls.h"
+#include "gnutls/x509.h"
 #include "httpd.h"
 #include "http_config.h"
@@ -26 +27 @@
                                          const char *arg);
 
+/*
+ * Create a trust list from a certificate chain (one or more
+ * certificates).
+ *
+ * tl: This trust list will be initialized and filled with the
+ * specified certificate(s)
+ *
+ * chain: certificate chain, must contain at least num certifictes
+ *
+ * num: number of certificates to load from chain
+ *
+ * Chain is supposed to be static (the trust chain of the server
+ * certificate), so when gnutls_x509_trust_list_deinit() is called on
+ * tl later, the "all" parameter should be zero.
+ *
+ * Returns GNUTLS_E_SUCCESS or a GnuTLS error code. In case of error
+ * tl will be uninitialized.
+ */
+int mgs_create_ocsp_trust_list(gnutls_x509_trust_list_t *tl,
+                               const gnutls_x509_crt_t *chain,
+                               const int num);
+
 int mgs_get_ocsp_response(gnutls_session_t session, void *ptr,
                           gnutls_datum_t *ocsp_response);